Bug 311114 – AX: ASSERTION FAILED on AXIsolatedTree.cpp:249 when running http/tests/site-isolation/accessibility/client/simple-iframe.html

• Component: Accessibility
• Status: RESOLVED FIXED

[Dominic Mazzoni]

I intermittently hit this assertion failure when running http/tests/site-isolation/accessibility/client/simple-iframe.html, which tests accessibility with site isolation. By fiddling with the test timing I was able to reproduce it reliably.

ASSERTION FAILED: AX: After applying pending root node, 15 reachable nodes but 17 are in the node map
reachableNodes.size() == m_readerThreadNodeMap.size()
/Volumes/Code/safari/OpenSource/Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp(249) : void WebCore::AXIsolatedTree::applyPendingRootNodeLocked()
1   WebCore::AXIsolatedTree::applyPendingRootNodeLocked()
2   WebCore::AXIsolatedTree::applyPendingChangesLocked()
3   WebCore::AXIsolatedTree::applyPendingChanges()

The bug happens when the in-process FrameHost (AccessibilityScrollView) is replaced with the out-of-process FrameHost, and then the FrameHost ends up in both m_pendingSubtreeRemovals and m_pendingAppends in applyPendingChangesLocked.

We never hit this before because it doesn't happen with DOM nodes or LayoutObjects - if the old object was removed from the AX cache, then it won't end up in m_pendingAppends. In this case both the old Widget and the new Widget exist, so the assertion is telling us we're leaking the old isolated objects.

With this fix, http/tests/site-isolation/accessibility/client/simple-iframe.html can be enabled.

[Radar WebKit Bug Importer]

<rdar://problem/173698630>

[Dominic Mazzoni]

Pull request: https://github.com/WebKit/WebKit/pull/61704

[EWS]

Committed 310800@main (8c8159f34720): <https://commits.webkit.org/310800@main>

Reviewed commits have been landed. Closing PR #61704 and removing active labels.